Government


Published Threat Intelligence, Not Cybersecurity Laws, Is What’s Needed

For several years now, Congress has been wandering around the wilderness, trying to figure out why so much of America’s intellectual property is being sucked into a giant vortex somewhere over Asia and whether they should do something to stop it, like maybe pass a cybersecurity law. They’ve taken innumerable swings at it, and struck out every time, with the two parties unable to agree on what needs to be in a cybersecurity bill and what entities should be covered by it. Now Congress is in recess and it looks less and less likely that anything will be passed before the end of the session. And, for once, we all should be thankful for our lawmakers’ inability to act.

Think Differently on Cybersecurity Or Fall Farther Behind, Former FBI Lawyer Says

People in the security industry often criticize the federal government for being woefully behind the times on information security, not understanding the current threat landscape and not having enough trained law enforcement agents who can handle sophisticated computer crimes. Steven Chabinsky doesn’t want to hear it. A longtime FBI lawyer and former chief of the bureau’s Cyber Intelligence Section, Chabinsky believes that the government is doing a better job at security than ever before, as is the private sector. But, he also believes the attackers are still gaining ground every day.

Huawei Denies Stealing State Secrets or Supporting Cyber Espionage

Huawei, the massive Chinese technology company that has come under criticism for its close ties to China’s government, is defending itself, saying that it has never stolen national intelligence or intellectual property and does not support any groups that do so. The company has been a frequent target of critics who allege that it trades information and secrets with the Chinese government, allegations its officials have consistently denied.


A Tempe, Arizona man was arrested Tuesday for allegedly taking part in the June 2011 attack on Sony Pictures Entertainment Inc.’s network, in which passwords and other personal data was stolen from one million user accounts.Raynaldo Rivera, 20, was charged with conspiracy and unauthorized impairment of a protected computer, which could earn him up to 15 years in prison if he is found guilty. He was ordered to appear in a Los Angeles courtroom Sept. 14.

The Air Force Life Cycle Management Center (AFLCMC) posted a broad agency announcement [PDF] recently, calling on contractors to submit concept papers detailing technological demonstrations of ‘cyberspace warfare operations’ (CWO) capabilities.

As security defenses have advanced and become more adaptive in the last decade, malware authors and attackers have had to respond, looking for new ways to get their malicious software onto PCs or exploit previously unknown vulnerabilities. One target is the system BIOS, the low-level instruction set that loads when the computer boots, and now the U.S. government has released some draft specifications for helping to secure BIOS implementations.

The U.S. Federal Trade Commission today announced it had finalized its settlement with Facebook, which is  now subject to biennial privacy audits for the next 20 years and requires its nearly 1 billion users opt in to any future privacy policy changes.

Black Hat is upon us and, with it, a lot of chatter about the dangers posed by so-called “APT,” or advanced persistent threats. Rather than get trapped in the hype bubble, Threatpost editor Paul Roberts took the opportunity to check back in with a recognized expert on detecting and combating APT-style attacks: Amit Yoran, the former CEO of NetWitness Corp. and now a Senior Vice President at RSA, The Security Division of EMC. Yoran says that the darkest days may yet be ahead in the fight against APT style attacks, with mounting attacks and a critical shortage of security talent. To cope, both private sector firms and the government need to stop fighting the last war and pivot to the kinds of practices and monitoring that can spot sophisticated attackers.